1 of 52

PARAPARAUMU COLLEGE

Risk Management for

School Business Managers

Preparing for Changing Conditions: From Compliance to Strategic Resilience

60-Minute Workshop | 15 July 2026 Presented by: Diane Bradley, Business Manager

2 of 52

Today's Agenda

Introduction and objectives

Risk, risk management and the School Business Manager’s role

The core risk framework and risk tools

Risk appetite and maturity

Risk categories

What’s on the horizon?

School Business Manager Risk Checklist

I’ve tried to pitch this session to cover material that is at the heart of risk management as well as more advanced and topical information.

I want to challenge our thinking around risk management - moving forward from a standard risk compliance mindset to more strategic risk leadership within our schools.

I’ll refer throughout to Boards and Principals, being in a state school environment myself, however, this presentation is equally applicable to charter, special and state-integrated schools

There will be an opportunity for discussion and questions at the end because I think it’s really important we share what we know and have the chance to discuss any issues we’re facing.

So please make a note of anything you want to bring up at the end.

But I’m conscious that this is a long presentation, so feel free to jump in during as well to break it up a bit.

3 of 52

01

SECTION

Introduction &

Objectives

Setting the scene

4 of 52

Diane Bradley

Chartered Accountant
Business Manager at Paraparaumu College
Board Secretary
1500 students; 170 staff
Previous roles: Chief Financial Officer / Project Manager / Business Change

5 of 52

Why am I here and why do I care about risk management?

I reflected on why I agreed to do this presentation - and it’s largely because I’ve never been afraid to wear the De Bono Black Hat in any role I’ve been in.

I don’t see thinking about the future and what might happen to upset an apple cart as a negative or failure-focussed thing to do.

I see it as a way to add value by asking the “what if” questions and focussing on what is needed to make something truly successful.

It’s those questions that sometimes others won’t ask, that challenge the “she’ll be right” thinking or group consensus. It helps to focus in on the things that really matter - both risks and opportunities.

I see one of my key roles as being the builder, maintainer and improver of fences - at the tops of cliffs.

Not the ambulance driver at the bottom who spends all their time reactively going from one avoidable situation or crisis to the next.

That doesn’t challenge or interest me……. it frustrates me.

I’ve managed large projects and programmes of work and an important component of these has been identifying and managing risks that could prevent the project being successful.

Having come into a school environment for the first time seven years ago I have been a keen observer, and hopefully, proactive improver of how our school is managed.

We are by no means a perfect school in terms of managing risks - we are on a journey as they say - and one that I would promote as a necessary and wholly worthwhile one.

Like me, I know our Principal and Board in particular like to be able to sleep soundly at night knowing that we are doing everything we can to help run the school in a safe and sustainable way.

As School Business Managers, we aren’t here to wrap our schools in cotton wool.

If we eliminate all risk, we eliminate learning, adventure, and growth.

I see one of our roles as being to identify a need that maybe others aren’t in a position, or don’t have the skills and knowledge, to see.

And then to design and build a safety net (or fence) sturdy enough that our students and staff can boldly take the risks that matter, knowing the school's operational, financial, and legal foundations are secure.

I am not an expert by any means, but my aim is to share my observations and knowledge with you.

6 of 52

Learning Objectives

1

Understand the New Zealand legal and regulatory risk framework (WorkSafe NZ, HSWA 2015, MOE)

2

Apply ISO 31000 risk management principles to your school context

3

Assess your school's risk maturity and identify priority gaps

4

Develop practical risk management strategies across key domains and with a focus on what’s on the horizon

5

Build a personalised risk action plan to take back to your school

7 of 52

02

SECTION

Risk, risk management and the School Business Manager’s role

The basics of risk and the part we play

8 of 52

What is risk and risk management?

Risk - The effect of uncertainty on objectives

Possibility that something will happen to impact on your school’s ability to achieve its goals
Downside Risk - of bad things happening (failure to prevent student injury)
Upside Risk - missed opportunities (failure to take advantage of AI appropriately)

I’m sure that you’ll all be familiar with the most basic definition of Risk - The effect of uncertainty on objectives.

It is the possibility that something will happen that impacts on your school’s ability to achieve its goals.

And, as we know, a school has many goals and external monitoring and complexity is certainly increasing.

Goals could be things like:

delivering a safe classroom environment - meeting Achievement and Attendance targets
holding a successful EOTC trip - staying within budget - having a great reputation within the community………

And because there are so many goals there are also likely to be several risks across all areas of your school.

The art is in working out the key risks and managing them well.

9 of 52

Why is risk management important in a school environment?

Robust risk management is critical for:

Legal compliance and duty of care
Protecting the learning environment for students
Safeguarding school assets and public funds
Protecting the schools reputation and community trust
Helping decision makers make informed and confident decisions

Risk Management - Is about managing uncertainty so our schools can thrive

For School Business Managers, Principals and School Boards, robust risk management is critical for several interconnected reasons:

Legal compliance and duty of care.

Under the Health and Safety at Work Act 2015 the School Board is the PCBU (Person Conducting a Business or Undertaking) and has a primary duty of care to ensure the safety of staff, students and visitors.

Under the Education and Training Act there are several board responsibilities, including ensuring that the school is a physically and emotionally safe place for all students and staff.

We play a pivotal role in ensuring the school complies with these and other legal obligations, avoiding costly fines, litigation or intervention from Worksafe or the Ministry, not to mention protecting people.

This covers things like EOTC and risks associated with incidents on school trips; managing hazardous materials, recruiting and managing staff and having volunteers work safely with our students.

Protecting the learning environment.

If a major risk materialises, whether it’s a ransomware attack locking the school’s IT servers, a major IT failure, or a burst pipe flooding a block, learning stops.

Effective risk management ensures business continuity, allowing the school to bounce back quickly and minimise any disruption to students’ education.

Safeguarding school assets and public funds.

Schools operate on tight, mostly publicly funded budgets.

Sound, systematic processes and robust financial risk management protect those limited resources from unforeseen expenses, budget overruns, fraud, or poor fiscal management choices, ensuring that every dollar possible goes directly towards student outcomes.

Planning for Plans B, C and D can help you pivot quickly if, for example a major revenue stream is lost temporarily or permanently or a school roll falls.

It makes us look like we know what we’re doing…….

Reputation and community trust.

A school’s reputation is one of its most valuable assets.

How a school anticipates and handles crises and traumatic events, cyberbullying scandals, poor ERO reports, critical or damaging social media commentary, or even complaints, directly impacts community trust.

Good risk management protects the school’s brand - ensuring it remains a trusted environment where parents and whānau feel safe sending their children.

Informed and confident decision making.

As I’ve said, risk management isn’t about avoiding all risk - it’s about taking calculated risks and seizing opportunities within boundaries and guidelines that the board sets and is comfortable with.

Whether you’re building a new sports facility, introducing a new digital device policy or wanting to change your school’s student management system, a clear risk assessment gives your senior leadership team and Board the confidence to innovate knowing that there are safety nets or fences in place.

We do need to always remember that managing risk is not about tying everything up in knots and making it so complex, difficult or negative that nothing is allowed, or nothing gets done……….

It’s about MANAGING UNCERTAINTY so that our schools are resilient and can thrive.

Risk management is not a compliance exercise, it’s a strategic management tool.

It’s looking through a protective lens and asking “”What could go wrong? What impact would that have? How can we prevent that from happening or minimize the damage should that happen?

Or through a positive lens and asking “What are the opportunities here? How can we benefit from them?

10 of 52

The risk landscape for schools

Regulatory and Legal

Health and Safety at Work Act 2015 Privacy Act 2020

Education and Training Act 2020 Crown Entities Act 2004

Employment Relations Act 2000 Human Rights Act 1993

Education (School Boards) Regulations 2000

Financial Accountability

Ministry of Education funding

Annual audit

Payroll compliance

Fraud exposure

Cybersecurity

People and Community

Staff wellbeing

Child safety

Community trust

Reputational exposure

Infrastructure

Building compliance

Deferred maintenance

Insurance

11 of 52

What role do / should School Business Managers play in risk management?

School Business Managers and other key support staff are uniquely positioned and well qualified to spearhead risk management in our schools
We have unparalleled visibility across a range of areas where risks and opportunities are presented
Our role is increasingly strategic, not just operational and firefighting
Our role is evolving with Boards and Principals increasingly looking to us not just to ensure compliance, but to provide strategic risk insights

While a Principal’s focus is primarily on educational leadership, pedagogy and student outcomes, we often oversee the structural and administrative machinery of the school.

Sometimes described as the “quiet engine” of the school we are uniquely positioned within what is an increasingly complex and changing environment of running a school.

We all have different roles within our schools, but along with our other support staff colleagues, we tend to sit at the intersection of:

Budgeting and financial management / Property projects and maintenance / HR management and payroll / Insurance / Health and Safety / Emergency Management / Policy Compliance and Processes / Communications / Information Technology

Our roles are evolving.

Boards and Principals increasingly look to us not just to ensure compliance, but to provide strategic insights.

I firmly believe that, in a school, risk is everyone’s business.

But the Business Manager is truly capable and probably the only one able to work alongside the Principal to build the and imbed a risk framework.

This provides the Board with confidence so they, and everyone, can sleep at night.

The goal is to create a “risk aware” culture not a “risk-averse” culture.

12 of 52

A hazard on its own does not a risk make

Before I go on, I’d just like to quickly cover some basics.

It’s probably a recap for most of you, but important fundamentals I think.

A classic one here.

A hazard on its own without context is not a risk………….. having a hazard register without a risk lens is a good start, but not what we need.

Depending on the context, the same hazard (in this case the road) can present different risks to be managed.

The risk can be very low if the road is sitting in the backcountry.

Or it can be very high if the road happens to be a busy two-lane one in a highly populated area outside a school.

Context is everything.�

If we don’t properly understand a hazard within a context, how can we properly assess and then manage any risk that results?

We run the risk (excuse the pun) of assessing it incorrectly and having far too many, or far too few, or inappropriate controls - which can lead us to not being taken seriously either way.

13 of 52

Where is your school placed for managing risks?

Accident or Injury and Incident Register

Hazard Register

Comprehensive Risk Register

Can I just ask everyone to stand up for a minute please.

Can you stay standing if you have an ACCIDENT OR an INJURY AND INCIDENT REGISTER that records things like injuries and near miss events at school and it’s updated and reviewed regularly?

Great

Keep standing if you also have a HAZARD REGISTER that records physical or chemical things across the school that could cause harm and maybe even assesses the risk of harm, has controls to manage risk that are checked regularly, and is updated and reviewed regularly, probably going to the health and safety committee or senior leadership team or possibly board occasionally?

Great.

Keep standing if you have a comprehensive RISK REGISTER that captures, assesses and has clear plans in place to manage a wide range of strategic, educational, reputational, operational, property and infrastructure, financial and technology risks and is presented and discussed at senior leadership or board meetings and is based on a risk matrix and definitions that have been discussed with and agreed by the board within the last year?

Super.

So that could have gone two ways……….. if you are all still standing I’d get you to talk amongst yourselves and I’d go grab a coffee……………

Or, as I hoped, there is benefit in continuing with the presentation.

14 of 52

03

SECTION

The Core

Framework and key risk management tools

WorkSafe NZ and ISO 31000:

the foundations of risk management

15 of 52

WorkSafe NZ — The Regulatory Context

WorkSafe New Zealand is New Zealand's primary workplace health and safety regulator. For schools, it has direct authority under the Health and Safety at Work Act 2015 (HSWA).

Proactive Engagement

WorkSafe expects PCBUs (schools) to proactively identify and manage risks — not just respond to incidents

Notifiable Events

Schools must notify WorkSafe of serious injuries, illness, or incidents (near misses) within 24 hours

Good Faith Defence

Schools demonstrating documented, systematic risk management are better protected legally

Officer Accountability

Principals and Board members as 'officers' must exercise due diligence — ignorance is not a defence

16 of 52

ISO 31000 — The International Risk Management Framework

Core Principles

Integrated into all organisational activities
Structured and comprehensive approach
Customised to your school context
Inclusive of all stakeholders
Dynamic — responsive to change
Based on best available information
Human and cultural factors considered

The Risk Management Process

1

Establish Context

2

Risk Identification

3

Risk Analysis

4

Risk Evaluation

5

Risk Treatment

6

Monitor & Review

7

Communicate & Consult

And secondly, ISO 31000:2025 is the international standard for risk management. It's not prescriptive — it provides principles.

The Ministry of Education expects schools to have a systematic approach to risk management that aligns with this framework.�

The risk management process involves seven iterative steps:

Establish Context that I talked about earlier — understand your school's environment, objectives, and stakeholders
Identify the Risk — identify events that could affect your school's objectives
Analyse the Risk — assess the likelihood and potential impact of each risk
Evaluate the Risk — prioritise risks using your agreed risk appetite and matrix. Does it end up being low, medium, high or extreme?
Treat the Risk — select and implement controls to modify risk
Monitor and Review — track risks over time and assess control effectiveness

7. Communicate and Consult — engage stakeholders at every step of the process�

The risk management process is a cycle, not a one-time exercise. 'Monitor & Review' feeds back into 'Establish Context'.

WorkSafe NZ have some fabulous resources - start with their “How to Manage Work Risks” fact sheet and if you need some light reading there’s the 23 page “Identifying, assessing and managing work risks” quick guide.

Managing risk is so much more than health and safety and yet I’ve found that this is by far the bulk of the information and resources available to manage risks in schools.

There is information about the Ministry of Education Risk Management Scheme and some risk information on the Ministry’s website but it is largely safety and property related.

I think we need to think more broadly across all the components that make up a school environment - not just the obvious ones.

And this is particularly true with a moving landscape that we are currently experiencing and I’ll be finishing with some thoughts on this.

17 of 52

Four key things you need to manage risks in a school

Standard way of identifying risks across all categories

Risk assessment matrix

- The likelihood and impact determines the initial risk rating

- The risk rating determines the required actions

Controls and required actions determine the residual risk rating

Risk register to bring it all together

So, to go through the basics of what you need to successfully manage risk in our schools.

You need:

standard way of identifying risks across all categories - that’s our risk language / how we talk about and describe a risk.

We can’t analyse a risk until we have described it in a clear, concise and consistent way that people can understand.

a risk assessment matrix.

This is a critical tool that absolutely needs board input and decision about where their risk tolerance sits.

some thoughtful work around controls and actions that can help to mitigate or eliminate risk.

These are important because it is the residual risk that is left that is of most importance.

And of course making sure the controls and actions are put in place, and remain in place, through monitoring and regular review.

a risk register to bring all of the information together in a single place that can then be filtered to show the board the most significant risks that they need to be aware of and make decisions about.

These decisions include things like whether or not they are acceptable risks as they stand, whether more controls are needed, and how much money they are prepared to allocate to reduce the risk if that’s even possible.

18 of 52

Identifying risks - having a standard risk statement

Cause > Event > Effect
Vague risks (or hazards) like “cyber security” aren’t helpful
There is a risk that <event> occurs, caused by <cause>, leading to <impact>

So unpacking the first one - a decent, understandable risk statement.

Vague statements are not helpful and can’t be assessed.

You really have to think about and describe the risk so you and others can discuss it.

You may need to talk it through and ask probing questions to fully understand what exactly the context is and what the actual risk is.

The key question to ask is “What might happen to impact on my school’s ability to achieve its goals” - and then write a short statement.

A useful way to do this, but not the only way, is by the statement “There is a risk that an event occurs, caused by something, that leads to an impact”.

You may have your own way of describing a risk which is fine.

I just suggest that it needs to be concise, easily understandable and consistent.

19 of 52

Identifying risks - examples

There is a risk of serious injury or death caused by unvetted contractors on site leading to WorkSafe NZ prosecution and Board liability
There is a risk of a large, unfunded and ongoing deficit caused by a significantly lower than forecast international student roll leading to staffing cuts and Ministry intervention
There is a risk of deepfake videos of teachers making their way onto a student-led TikTok account caused by malicious AI content leading to loss of community trust, reduced enrolments, low staff morale and staff resignations
There is a risk of a ransomware attack caused by insufficient staff training on phishing, leading to a total loss of financial records and school-wide operational shutdown

20 of 52

2. Assessing risks - The Risk Assessment Matrix

Using the Matrix

Low

Monitor, annual review

Medium

Documented controls required

High

Urgent treatment plan needed

Extreme

Immediate Board escalation

The risk matrix is a key tool in your risk kete. It’s also called a heat map and it looks pretty.

It is used to assess all types of risks, not just health and safety risks or hazards.

As the board is interested in primarily the Extreme and High risks they get to decide the colour of the boxes.

And to do that they need to firstly understand and agree with the definitions of Likelihood and Impact that we are using - I’ll cover those two things in the next slides.

Then they need to decide which combination of Likelihood and Impact they consider to be Extreme, then High and so on.

Basically, colouring the boxes by applying their collective judgement about risk.

A very risk averse board will have more Extreme boxes and so will want to see and monitor the schools management of many more risks than a more pragmatic and risk aware board that has fewer Extreme boxes and relies on school management to manage low and medium rated risks.

This is where we, in our roles as Business Managers, can advise and support the principal and board.

By understanding our school, the risk landscape and the board, we can propose a risk assessment matrix and discuss it with them so they have full knowledge before agreeing to the matrix and the colour boxes.

�It’s absolutely critical that they have the opportunity to ask questions and challenge our thinking.

After all, they are the ones who, as the PCBU, carry the primary responsibility.

21 of 52

2. Assessing risks — likelihood × impact

22 of 52

2. Assessing risks — likelihood × impact

My thinking is that we should have a number of different categories of risk, and each risk category should have a different set of risk impact descriptions so that we can fairly assess impact, should that risk occur.

You can see here that the impact of a financial risk occurring is different to the impact of a health and safety risk happening on the previous slide.

This makes sense as you can’t assess financial risk against impacts of “minor injury requiring first aid” or “catastrophic injury leading to loss of life or permanent disability”

And a word of caution. You should always present and agree your matrix definitions with your board.

Two reasons for this.

By talking them through it, It helps to improve their knowledge and understanding of risk.

And it also means that they get to make the final decision about what they consider to be a Major or Catastrophic impact.

What is 'Major' for one school may be 'Catastrophic' for another - so it is school and school board specific.

23 of 52

3. Controls and Actions - then re-rate the remaining risk

Once you have assessed the impact and likelihood you map it on the risk matrix to get your initial risk rating.

This then determines the priority and type of treatment (controls and mitigations) and frankly, how much time and effort you spend on it.

Once you’ve agreed and documented your mitigation strategies and controls you then need to reassess the risk and maybe adjust the risk rating down as hopefully those controls have reduced the risk rating.

The adjusted risk rating is now called the residual risk rating.

It is this risk that the board is particularly interested in - the “uncontrolled” risk.

Next actions depend on the residual risk rating.

For Low risks - we’re comfortable with them. They’ll be managed with low touch, few controls, low level monitoring and annual review.

For Medium risks. These risks need standard controls, documented and actively managed and checked to ensure they’re operating. Possibly with quarterly review.

High risks need active and documented management plans, a risk owner and more regular checking of controls and more regular review to see if anything has changed.

Reporting is likely to be to the principal with escalation to the board if needed, particularly if something changes.

Extreme risks need board attention and direction.

Often, decisions need to be made about alternatives to the activity, or additional significant controls and actions, which in many cases may result in potentially large, unbudgeted expense.

For these risks, it’s an honest conversation about what can reasonably and practicably, be done to manage the risk down to a level that is acceptable to the board.

These extreme risks need immediate attention.

In some cases, if the board remains unsatisfied, and the level of risk cannot be reasonably and practicably reduced, then the activity or whatever the cause is, needs to stop.

So you can see that if the Extreme risk level is set too low - that is, you have too many dark red boxes, you’ll probably need more than one full time risk manager to manage the resulting risks across the school.

24 of 52

4. Risk register - pulls all the information together

25 of 52

04

SECTION

Risk Appetite

& Maturity

How much risk should your school accept?

How mature is your risk management?

26 of 52

Understanding Risk Appetite

Risk Appetite

The amount and type of risk your school is prepared to accept in pursuit of its strategic objectives. Set by the Board.

Risk Tolerance

The acceptable variation around your risk appetite — the 'boundaries' within which risk management operates day to day.

Risk Capacity

The maximum amount of risk your school could absorb before it threatens its ability to continue operating.

The Board sets risk appetite. The SBM operationalises it and reports against it.

Risk appetite is increasingly appearing in school governance frameworks.

It’s the amount and type of risk your school is prepared to accept and it’s set by the Board.

Some examples of risk appetite statements for schools:

�- 'We have zero tolerance for health and safety incidents involving students'�- 'We accept moderate financial risk when pursuing capital improvement projects'�- 'We have low tolerance for reputational risk'

�I think one of our roles is to

understand the Board’s risk appetite
translate that into operational procedures, controls and reporting that are aligned to that
and advise the Board on whether the school's actual risk exposure is within appetite or if the school is overexposed.�

Risk tolerance is the acceptable variation, much like a financial variance to budget.

Risk capacity is the maximum amount of risk your board is willing to accept before it must act.

.

27 of 52

Risk Management Maturity Model

Assessing your school’s risk maturity is something that can be used to help assess where you’re at and guide improvement.

Level 1 is Ad Hoc - Largely reactive with no formal risk management processes in place, or they aren’t being followed. Risk is managed informally and often after incidents occur.

Level 2 is Developing. Some policies and procedures exist but are inconsistently applied. A risk register may exist but it’s not comprehensive and it’s not regularly reviewed.

Level 3 is Defined There are documented processes, consistently applied and a comprehensive set of risks. The risk register is reviewed by the Board at least annually and the risk appetite is clearly articulated.

Level 4 is Managed Risk management is measured and monitored. It’s well Integrated into strategic planning and operational decision-making.

Level 5 is Optimised There is a continuous improvement culture. Risk data drives decisions and the school learns systematically from near misses and incidents

28 of 52

Questions to think about — Rate Your School's Risk Maturity

1. Does your school have a formal, documented risk register?

Response options: Yes / Partial / No

2. When did the Board last review the risk register?

Response options: Within 6 months / 12 months / Longer / Never

3. Do you have documented business continuity plans?

Response options: For all critical functions / Some / None

4. Are risk management responsibilities clearly assigned to individuals?

Response options: Yes, documented / Informal / No

5. Does risk management inform your school's strategic planning?

Response options: Always / Sometimes / Rarely

Discuss: What level are you at overall? What's your biggest gap?

Where do you think your school is positioned?

Here are some questions that can help you to assess your school’s risk maturity.

Can you spend a couple of minutes talking to the person next to you or nearby, about how your school is placed

3 minutes

Thanks for that.

Do we have any schools operating at Level 5? Level 4?

Most New Zealand schools operate between Level 2 (Developing) and Level 3 (Defined).��Level 3 is achievable and is the expectation from the Ministry and WorkSafe.

�Level 4 and above requires investment in systems, training, and governance.��If you are on a risk management journey, don't try to jump from Level 1 to Level 5.

Focus on the next level up. It takes a while and needs a champion to make sustained progress.

The important thing is to note where the gaps are.��Most groups will identify gaps in documentation and Board reporting frequency.

The key message is that, even if you're at Level 2 today, having a plan to reach Level 3 is what matters.

29 of 52

05

SECTION

Health and Safety

Risk

HSWA 2015: Your obligations

and practical application

30 of 52

HSWA 2015 — Key Obligations for Schools

The School as PCBU

Provide and maintain a healthy and safe work environment for staff, students and visitors
Provide safe plant, equipment, and systems of work
Ensure safe use, handling, and storage of plant, structures, and substances
Provide adequate welfare facilities
Monitor workers' health and workplace conditions
Provide health & safety information, training, and supervision

Officers (Principal, Board Members)

Exercise due diligence to ensure PCBU obligations are met
Acquire and keep up to date with H&S knowledge
Understand school operations and H&S hazards/risks
Ensure adequate resources for H&S
Verify school has processes to identify and manage risks
Verify school has processes to receive worker input on H&S

As I’ve covered and you already know, there are direct legal obligations on schools, Principals, and School Boards as PCBUs.

You can see them on the slide and I won’t go through them.

I do want to say though that Officers (Principals and Board Members) must exercise 'due diligence' — and they cannot delegate this responsibility.

We usually play an important role here.

We are often the day-to-day operational lead for Health and Safety and Emergency Management, supporting the Principal (officer).

And this whole area is critical.

It includes Child Protection in Schools and compliance with both the Education and Training Act and also the Children’s Act 2014.

So it impacts on staff recruitment and covers staff and volunteer police vetting and safety checks which need to be carried out.

I know one thing I’ve tightened up on is having a documented risk assessment completed and signed off after police vetting and before making decisions to bring on relievers, hire support staff and have volunteers work with our students.

It also includes Education Outside the Classroom and this is a big area which hopefully you have a senior person in your school fully across, exercising delegations well and possibly using the Education Outdoors NZ (EONZ) Safety Management Planning and Toolkit resources which are great!

Under HSWA maximum penalties are quite scary for major breaches

�- Individual eg a worker: Up to $300,000 fine and/or 5 years imprisonment�- Officer of a PCBU eg board member or principal: Up to $600,000 fine and/or 5 years imprisonment�- PCBU eg school: Up to $3,000,000 fine��The key messages to take away here are that:

- ignorance is not a defence

- “so far as is reasonably practicable” is the standard

- and well documented risk management demonstrates good faith should you ever be on the receiving end of a WorkSafe NZ visit which I hope you never are.�

31 of 52

Managing H&S Risks — The Hierarchy of Controls

Elimination

Remove the hazard entirely

Substitution

Replace with something safer

Isolation

Separate people from the hazard

Engineering

Controls

Physical safeguards

Administrative

Controls

Policies, training, procedures

PPE

Last resort — personal protective equipment

More Effective

Less Effective

I’m sure you know this, but it’s worth repeating.

The Hierarchy of Controls is a WorkSafe NZ and HSWA requirement.��The key principle is to work down the hierarchy — always try to eliminate first, PPE is a last resort.��Common school examples would be:

�- Elimination (most effective): Remove the hazard entirely. Don’t just put a sticker on a broken chair, remove it to a safe place where no one will use it.

- Substitution: Replace with something safer. Replace chemical cleaner with water-based alternative

�- Isolation: Separate people from the hazard. Fence off a construction area

�- Engineering Controls: Install physical safeguards. Install machine guards in Tech workshops

�- Administrative Controls: Policies and Procedures. Safe food allergy protocols or food handling requirements for the Canteen

�- PPE (least effective): Personal protective equipment. Safety glasses in Science labs

32 of 52

06

SECTION

Financial Risk

Management

Protecting your school's financial

health and public accountability

33 of 52

Types of Financial Risk in Schools

Budget Risk

Unexpected cost increases
Over-reliance on supplementary funding eg International Students
Enrolment decline impacting operational grants

Cash Flow Risk

Timing mismatches between income and expenditure
Major capital projects depleting reserves
Late payment of MOE grants

Fraud & Misappropriation

Inadequate segregation of duties
Insufficient oversight of delegated spending
Cyber fraud / business email compromise
Vulnerabilities in the digital payment landscape

Audit & Compliance

Failure to meet Office of the Auditor-General requirements
Significant negative audit findings
Non-compliance with Financial Reporting Standards

There are a number of financial risks in schools and the most common are included here. I’m sure there are many more.

And if you were wondering about fraud statistics, NZ schools are not immune.

Fraud incidents typically involve:�- staff with unilateral control over payments and reconciliation�- poor oversight of petty cash and credit cards�- fictitious vendors or inflated invoices

For me, managing financial risk is so much more than “not overspending” - it’s more about thinking of the challenging and changing conditions we work in, and doing some Scenario Planning.

With the volatility we’ve seen in international student numbers for example and the direct impact on income and our bottom line, a “static” budget is often a risky budget.

We should probably run three budget scenarios for the board.

“Optimistic”; “Realistic” and “The sky is falling”.

This ensures that, if the sky does indeed fall, we already have a pre-approved plan for what actions we can take and where we can cut back so that the school can continue operating without panic.

34 of 52

Financial Controls & Governance

Internal Controls

Dual authorisation for payments above threshold
Segregation of duties (who requests ≠ who approves ≠ who reconciles)
Documented delegations of financial authority
Regular bank reconciliation and review by non-signatory
Annual independent audit preparation

Board Governance

Board reviews monthly financial reporting
Risk register includes financial risks
Investment and reserves policy in place
Conflicts of interest register maintained
Auditor engagement managed by Board, not SBM

You’ll likely be familiar with the key controls that help manage risk in these areas:

For budget risk we have

monthly budget monitoring
board (or principal) approval of over expenditure
conservative forecasting.

For cash flow risk we have:

cash flow projections based on solid assumptions
a reserves policy
awareness of the Ministry funding schedules on Pourato

For Fraud and Misappropriation we have:

segregation of duties
dual authorisation
documented delegations

For Audit and Compliance we have:

annual independent audit
Ministry finance and auditor general guidance to follow
to meet Financial Reporting Standards

We should have documented core internal control principles which are followed. Like

No single person controls an entire financial transaction — from request to payment to reconciliation. That’s a key control.
All spending authorities must be documented in a Delegations of Financial Authority policy signed off by the Board to the Principal and then by the Principal as they sub-delegate
Bank statements are reviewed monthly by a Board member who is not a signatory
Credit cards are reconciled monthly with receipts; and personal expenditure is not permitted

�There is a really good Ministry resource that I recommend - the 'Financial Management Guidance for Boards' — available on Education.govt.nz

It’s good because it looks at things from the Board’s perspective.

It’s also worth noting that the FISH (Financial Information for Schools’ Handbook) was updated quite recently with stricter guidance on internal controls - called Internal Assurance.

It’s not enough to say we have controls in place - we have to prove we tested them ourselves before the auditors arrive.��Here’s a good governance quote for you for financial risk management……….'Trust but verify.'

35 of 52

07

SECTION

Reputational

Risk

Protecting your school's standing

in the community and beyond

36 of 52

Managing Reputational Risk

Sources of Reputational Risk

Social media incidents (staff, students, parents)
Serious H&S incidents making local news
Privacy breaches (Privacy Act 2020)
ERO adverse inspection findings made public
Staff conduct issues or employment disputes
Financial mismanagement disclosed publicly
Complaints not managed well

Crisis Communications — The 3 Rules

1

Speed

Acknowledge within 1–2 hours. 'We are aware and investigating' is better than silence.

2

Transparency

Don't hide facts that will emerge later. Partial truth often damages more than full disclosure.

3

Empathy

Lead with care for people affected — not defence of the school's position.

Note: Involve Principal and Board Presiding Member before any public statements.

This is an area often talked about, but I’m not sure it’s managed particularly well from a risk perspective in schools.

It’s probably underestimated and there are few, if any, risks and mitigating actions written down and proactively managed.

Which is odd because a single incident — handled badly — can have long-lasting and serious consequences.

You can see here some of the key sources of reputational risk.

One bad suspension process or a viral TikTok can undo years of community trust.

And something I’m really exercised about is making sure that your complaints policy and process are not just on the website, but they are followed to the letter.

Procedural errors are the leading cause of successful legal challenges against boards.

The Ministry Risk Management Scheme includes cover for legal assistance - use it if you need it.

Think about your school - do you have plans in place to manage any of the high risk scenarios that have been identified?

And just a topical reminder: Schools should have a clear social media policy for staff AND for official school accounts.

For social media and crisis communications - it’s a good risk strategy to manage the narrative in real time.

You can see the 3 suggested rules up there - speed, transparency and empathy.��The key message is that reputational risk is best managed proactively — through culture, clear policies, and rapid response protocols — not just reactively when something happens.

37 of 52

08

SECTION

Operational Risk

& Business Continuity

Keeping your school running

when things go wrong

38 of 52

Operational Risk — Key Categories

IT & Cybersecurity

Ransomware / cyberattack
School management system (SMS) failure
CCTV and door access failures
Cloud service outage

Key Person Dependency

SBM or Principal sudden absence
Critical skills held by one person
Payroll knowledge concentrated
No documented succession plans

Supply Chain

Contractor failure during capital project
Cleaning / maintenance provider withdrawal
Catering vendor non-compliance
Uniform supplier delays

Data & Privacy

Student data breach
Staff records compromise
Third-party software collecting data
Inadequate data retention/disposal

I’ve included some key operational risk categories here you may already have - maybe not?.

Technology risk is no longer the IT person’s problem…… it can be an operational nightmare.

Cybersecurity is the fastest-growing operational risk for NZ schools.

If your school is hit with ransomware you probably won’t be able to access student records, communicate with parents, provide learning for students, access financial systems, pay staff potentially.�

So IT and Cybersecurity risks could stem from ransomware; data breaches; equipment failure or service outages at any time.

Controls you could consider include:

- Multi Factor Authentication on all admin accounts. If you haven’t enforced it yet it could be your number 1 priority.

- offline backups

- having an equipment replacement schedule that reflects aging assets

- having an incident response plan tested and waiting to kick into place when you need it

- making sure you know what to do, when. Make sure you know about and follow the guidance from the National Cyber Security Centre.

- If your school is a member of the Ministry’s Risk Management Scheme they advise that you contact Sedgwick to help with resolution (they are a branch of NZ Insurance)

You may also be aware of the N4L (Network for Learning) Secure Access Solution which aims to improve school’s IT security through segmenting networks and identifying users and devices.

It’s the final phase of the Wi-Fi upgrade process and makes a network less vulnerable to security breaches and online threats - helping to protect a school’s student and staff data.

If you’re linked in with N4L you may want to check it out.

Key person dependency is often overlooked or undercooked.

A sudden absence of a key person, or having important knowledge, like payroll, concentrated in one person are examples of this.

Controls could include:

Identifying key staff and planning for scenarios where they aren’t available
Cross training for key roles
Putting succession plans in place
Having key processes fully documented and up to date

We’ve developed a google drive Annual Calendar that contains all the key documents and links to our repeatable, term by term events and activities.

This was born out of my frustration that, each year, at the same time when an event would be upon us, as an SLT we’d start to reinvent the wheel and scramble to recall information or where to find feedback from last year’s event.

It’s a work in progress but it’s so useful and will come into its own if the leader normally responsible for an activity happens to be away or unable to lead that activity.

Supply chain management is also often overlooked.

Contractor failure, a key maintenance provider withdrawal, particularly one that holds years and years of knowledge about your school and its idiosyncrasies…….. so annoying.

Controls could include:

strong contract management and notice periods
backup suppliers who know your school
service level agreements

Data and Privacy is a topical risk also

Controls in this space could include:

ensuring your data classification and retention schedule is up to date and compliant with Public Records Act requirements
having safe disposal procedures for equipment and devices.

By the way, it’s not a trick question, but do you know who your Privacy Officer is? Hands up

Are they fully trained and up to date in this fast-paced changing environment?

The resources and online training available through the Office of the Privacy Commissioner website are excellent by the way.

The list of things to think about here really is endless.

39 of 52

Business Continuity Planning (BCP)

1

Identify Critical Functions

Payroll, student enrolment, emergency communications, data access, H&S systems

2

Set Recovery Time Objectives

For each critical function: how long can it be unavailable? What data can be lost?

3

Identify Dependencies

People, systems, external providers, data and documents needed for each function

4

Develop Recovery Strategies

Manual workarounds, backup systems, mutual aid agreements, emergency contacts

5

Document & Communicate

Written BCP accessible offline; key staff trained; Board informed and approved

6

Test & Review

Annual tabletop exercise; review after any incident or major change

Just a quick note about Business Continuity Plans.

A BCP ensures your school can continue critical functions during and after a disruption.

Business Continuity Planning is closely related to Emergency Management — but a BCP focuses on maintaining operations, while emergency management focuses on immediate safety response.��Ministry guidance is that schools are required to have emergency management plans. Business Continuity Planning is an extension of this.

There are six steps to building your BCP

Identify Critical Functions - these are what you determine as a school to be your critical functions.

Set Recovery Objectives - how long can each function be unavailable? How long can a system be offline for?

Map Dependencies - who are the people / what are the systems / who are the external providers required for each function?

Develop Recovery Strategies - think about manual workarounds, backup systems, backup data able to be accessed

Document and communicate - make sure your BCP is available hard copy maybe in more than one location. Have all key staff trained, don’t forget to train new staff. The Board should approve the BCP

TEST and review - will it actually work when you need it to? Do an annual tabletop exercise and review your BCP after every significant incident.

40 of 52

TAKE-AWAY ACTIVITY — Business Continuity Scenario

Scenario: The Ransomware Attack

Monday morning. Your school's administration network is locked. A ransomware message demands payment. Your Student Management System, payroll system, financial system and all shared drives are inaccessible. It is 3 days before the end of the pay period. 85 staff are waiting to be paid.

First 2 hours

Who do you call first? What do you NOT do? (Hint: don't pay the ransom!)

Payroll solution

How do you ensure 85 staff are paid on time with no system access?

Communication

Who needs to be told, and what? Parents? Staff? MOE? Media?

Prevention

What 3 things would have reduced the impact of this attack?

We haven’t got time now, but here’s an exercise you may want to do back at school as it is an event that could happen.

Pause for a bit

If you want the answers email me………...

Key answers:

�First 2 hours: Call your IT provider, Network for Learning N4L, Principal, Board Presiding member. Contact the National Cyber Security Centre (NCSC) using their online Pūrongotia Reporting Tool. . DO NOT pay. Isolate affected systems.��Payroll: Use last pay run data as baseline. Contact payroll provider. Issue manual/bank transfers with Emergency Expenditure authority.��Communication: Staff immediately (reassure them on pay). Board (as soon as PCBU aware). MOE (notify under reporting obligations). Privacy Commissioner if student/staff data compromised. Media only if story breaks externally — prepared statement ready.��Prevention: Offline backups, multi-factor authentication on all accounts, staff phishing training, tested incident response plan.

41 of 52

09

SECTION

Property Risk

& Infrastructure

Managing your school's physical

assets and built environment

42 of 52

Property Risk & Infrastructure Management

Building and Infrastructure Compliance

Building Warrant of Fitness (BWOF). Asbestos management. Electrical testing. Managing contractors on site.

MOE Property Framework

MOE retains title to school buildings. Schools manage property through the 10-Year Property Plan (10YPP). The SBM is typically the key contact for the 10YPP — ensure it is current and realistic.

Insurance

Schools carry cover through the MOE's property insurance programme. Review scope annually. Contents insurance and public liability may require separate school-funded cover — check your policy.

Deferred Maintenance Risk

Deferred maintenance creates compounding risk: higher future costs, H&S exposure, and building deterioration. Document all known defects and include in risk register with estimated remediation costs.

These are just examples of the risk areas to look at here. You’ll likely have many more.

The point is - think about this from your school’s perspective and what is a risk for your school.

This is a massive year for school property and changes.

I’m going to cover the potential impact of the new New Zealand School Property Agency in a minute

In the meantime, a few tips……..

you all have a Ministry Property Advisor allocated. It’s important to develop and maintain a good working relationship with them, and will be with the NZSPA when it’s up and running.

ensure that your 10YPP is clearly aligned to your Strategic Plan

make sure you prioritise your health and safety critical items in your 10YPP - these take precedence in MOE approvals

remember to insure your overcode buildings - board owned buildings - and review your needs regularly

don’t undercook your cyclical maintenance plan in terms of coverage and realistic cost. It will come back to bite you.

The Ministry has great information on their website for managing property, projects and property contractors.

43 of 52

10

SECTION

What’s on the horizon?

What should we be thinking about?

Keeping ahead of developments

44 of 52

Changes on the horizon - what are the risks?

AI

Poses a range of risks including academic integrity, data privacy, potential to amplify biases including cultural and gender, impacts for recruitment and retention, changing skill sets needed

Increasing number of students with complex learning and behavioural needs

This impacts school environments and spaces, attendance, increased support needs and potentially staff and student safety, staffing numbers and costs associated with that, impacts on other students ability to learn

Curriculum change fatigue and overload

School staff could experience workload strain and potential burnout driven by significant policy shifts and widespread curriculum changes, impacts on student learning

Climate vulnerability and infrastructure risks

Increase in number and severity of weather events could put infrastructure at risk with an increased chance of school closures and facilities needing to be used as community hubs when weather/climate events occur

Here are a just a few examples of changing conditions that will likely impact on schools so will be worth you considering.

AI is a big one - it’s also an opportunity, so an upside risk.

There are so many things to think about here

not having a robust policy that’s being followed
a lack of understanding of how AI is being used and what tools are being used
is your school meeting all its legislative requirements, like Privacy, copyright, Māori data sovereignty?
and ensuring that there’s always human oversight - looking for and understanding the cultural, gender and other biases in AI tools

Managing the rapid implementation of the refreshed national curriculum and NCEA overhauls is also a topical risk to consider.

What are the risks and how are we managing them, if we are managing them at all?

I would say that staff workload and change fatigue may present a very real threat to the board’s duty to maintain a safe workplace

45 of 52

Changes on the horizon - what are the risks?

Legislative Change

Education and Training (System Reform) Amendment Bill

Legislative Change

Health and Safety at Work Amendment Bill

Legislative Change

Employment Leave Bill

It’s fair to say that there is a lot of legislative change happening at the moment. It’s hard to keep up with, but we should.

The Ministry’s School Leaders Bulletins are good for information, but it is our responsibility to keep up to date with changings coming down the track.

One of the key pieces of legislation impacting schools and school boards is the Education and Training (System Reform) Amendment Bill.

Except it’s no longer a Bill, it’s an Act as it received royal assent on the 25th of June………….. that’s how fast change happens!!

It follows on from the passage of the Education and Training Amendment Act 2025 that came into effect in November 2025 and that introduced a lot of change.

The Act restructures key system-level settings across workforce quality, school property, regulatory functions, curriculum, attendance and school choice.

I’ll just run through a couple of changes that this Act brings about as it should be something that your principal and the school board are thinking about in terms of how best to take advantage of the opportunities presented by the changes and how to manage the risks associated with them.

Firstly, the Act establishes the New Zealand School Property Agency (NZSPA) as a Crown agent coming into effect by 1 November this year.

It will manage, plan, build and maintain school property, removing this function from the Ministry of Education.

There was an opportunity for schools to “opt-in” to a variation which was for boards to bypass NZSPA and retain local decision making over planning and delivering their own projects.

This was a major strategic choice regarding risk that your board may or may not have known about or made a decision about.

I’m curious - Did any schools here “opt-in” to this variation??

Another big change with the Act follows on from the changes to Board objectives that were set out in section 127 of the Education and Training Act relating to Attendance.

Boards now have Attendance as an essential supporting objective to the highest priority objective of Achievement. Yep, that sounds like a Board objective that might need a bit of risk management thinking about………

There were new requirements to implement Attendance Management Plans and strictly follow the Stepped Attendance Response (STAR).

Under this new Act, Principals will no longer have broad discretion to determine justified/unjustified absences - instead exemptions must align with strict, standardised rules that will be set by the Secretary for Education.

Failure to meet standardised benchmarks triggers a progressive series of monitoring, review, and statutory interventions by the Ministry and the Education Review Office (ERO).

The four intervention levels are “Requirement to provide information” then “specialist advisory support” is provided to the school to assist; then the Ministry can issue a formal direction instructing the board to take specific actions; and then finally if all else fails, “statutory appointment” is the final level where either a Limited Statutory Manager is appointed to take over attendance and student welfare functions or a Commissioner is appointed to replace the Board.

My understanding is that, under new Education Review Office escalation powers, if a school is declared to be “of serious concern” then the pathway from ERO reporting to Ministry statutory intervention can occur in as little as 60 days. Wow, that’s food for thought.

Also, Boards are legally required to publish their Attendance Management Plans on school websites and report their progress to their community. So a failure to meet objectives will become pretty public pretty quickly and this could damage a schools reputation.

I don’t know about you, but I’m thinking that there is probably quite a bit of risk for Boards in these changes that might require a bit of risk management thinking and planning……

If I was a Board member I’d be expecting things like regular reporting against attendance targets, early notification of worrying trends, and action plans to address areas that are “off target”.

These all sound like risk mitigations to me.

I’ve just gone through one piece of legislative change - there are another couple worth mentioning:

2. The Health and Safety at Work Amendment Bill

This Bill officially passed its third reading in the New Zealand Parliament on June 30, 2026.

It’s expected to officially take effect on April 1, 2027 so PCBUs have time to prepare for the new requirements..

It is designed to reduce red tape and clarify legal obligations for businesses which includes schools.

It introduces a new "critical risk" framework and it legally changes the duties of board “officers”.

Boards are no longer expected to treat all hazards equally instead focusing on the prevention of serious harm and critical physical and emotional safety risk.

So although we must still manage all workplace risks we will be legally mandated to actively prioritise the “major hazards” first - something I would like to think that we had been doing anyway…..

These major hazards will include:

asbestos and hazardous substances (particularly relevant during school renovations or science and tech lab operations) - or if you have any sand in your classrooms????
contractor management. So physical construction, roofing, tree maintenance and other high risk activities
vehicles and traffic zones. So heavy vehicle movements, school bus loading zones and pick up/drop off areas where fatal or serious incidents are statistically more likely
severe workplace illnesses. The Bill elevates chronic and long-latency health conditions onto the critical risk category, requiring more proactive air quality or environmental monitoring than before.

It also clarifies “officer due diligence” to focus on governance and provides an exhaustive list of duties or “reasonable steps”, and specifies duties for those holding multiple roles.

WorkSafe will be developing and releasing guidance, training and support materials between now and the implementation date to help us understand and apply the changes.

So watch out for that one - and you can start thinking now about how that change to prioritising the risks that matter the most will impact your school and the risks on your health and safety risk register.

Has anyone here done a deep dive into this Bill and what it may mean for schools? Anything to add?

That’s a shame, because I expect, like most of you, that it will likely be us who have to do the research, work out what it means, and take appropriate action!!

3. The final change I want to mention briefly is the Employment Leave Bill because that will also impact on schools and staff.

This Bill is being introduced to replace the Holidays Act 2003 and it’s moving through the Select Committee process currently.

The Bill intends to simplify highly complex leave calculations and mitigate systemic payroll errors.

There are substantial changes proposed to the way leave entitlements are earned, taken and paid - the key ones that will impact school staff, and particularly part time workers potentially are:.

annual and sick leave will accrue from day 1 in hours, against standard hours, rather than being provided as annual entitlements
employees will use 1 hour of accrued leave for every hour they take off work and they’ll be able to take part days
part time employees will receive sick leave directly proportional to contracted hours whereas now they receive 10 days per year, the same as full time employees.

Again, watch the legislative space and start thinking about how these changes will impact on schools, given that they may impact on staff, and any risks that may result.

I know Collective Agreements come into play here also, so we’ll all be watching.

46 of 52

So, just to finish, here’s a new risk…………

Accelerated and multiple curriculum resets cause acute teacher fatigue, resulting in high attrition rates and recruitment difficulties
Inherent risk: High. Likelihood Possible / Impact Major
Controls: Allocate more TA support hours where needed to alleviate pressure; target and prioritise PD funds to where needed to support; monitor staff wellbeing through survey and identify key people risk
Residual risk: Medium. Likelihood Unlikely / Impact Major
Action/Monitoring: Monitor staff turnover rates; Principal reports on staff wellbeing to Board; PLD uptake monitored and targeted as needed; one on one support for key people

47 of 52

11

SECTION

The School Business Manager

Risk Checklist

Your practical guide to risk

readiness across all domains

48 of 52

School Business Manager — Risk Readiness Checklist

Framework

Risk register maintained and reviewed by Board (at least annually)
Risk appetite statement approved by Board
Risk management policy in place and risk management processes are being used

H&S

HSWA 2015 obligations understood by officers
Hazard identification process documented
Notifiable event procedure in place

Financial

Delegations of financial authority documented
Segregation of duties in place
Fraud policy and whistleblower process available

Reputation

Social media policy for staff in place
Crisis communications protocol documented
Privacy breach response process defined

Operations

BCP documented for critical school functions
IT/cybersecurity plan including offline backups
Key person dependency risks identified

Property

Building Warrant of Fitness (BWOF)
Contractors on site are well managed
10YPP current and submitted
Insurance reviewed annually for adequacy

49 of 52

Your Risk Management Action Plan

What will you do when you get back to school?

Next Week

Share one risk insight from today with your Principal
Check when your risk register was last reviewed by the Board
Confirm you have a documented fraud prevention procedure

Next Month

Complete the SBM Risk Readiness Checklist for your school
Schedule a BCP tabletop exercise with your senior leadership team
Review your H&S incident reporting process — is it fit for purpose?

Next Term

Present a risk matrix and appetite statement to your Board for endorsement
Update or create your school's risk register using today's frameworks
Complete your 10YPP review and prepare your deferred maintenance list

50 of 52

Key Takeaways

1

Risk management is a strategic function — not just a compliance exercise

2

The SBM is uniquely positioned to lead risk culture across the school

3

Financial controls protect your school, your Board, and your reputation

4

A tested BCP is worth more than a perfect BCP that has never been reviewed

5

Fast pace of change means we need to keep scanning; be aware; be prepared to advise and support on changes that may impact your school

51 of 52

Key Resources & References

WorkSafe NZ — Education Sector

Worksafe: School FAQs

H&S guidance specific to schools, including worker participation, risk management tools

Ministry of Education — School Finance

MoE: Day to Day Financial Management

Financial management guidance for Boards, audit resources, property framework

National Cyber Security Centre — Schools Cybersecurity

NCSC

Practical cybersecurity advice, incident reporting, ransomware response guidance

Office of the Privacy Commissioner

Boards and Privacy

Privacy Act 2020 guidance, breach notification requirements

Standards NZ — ISO 31000:2025

Standards NZ: ISO 31000:2025

The international risk management standard (purchasable)

NZ School Boards Association - GovHub

GovHub Resource Centre

Governance resources, policy templates, Board training for risk oversight

52 of 52

Thank You

Questions & Discussion

Diane Bradley can be contacted at: brd@paraparaumucollege.school.nz